Resource Provisioning and Configuration

Quick Answer: Azure AI resources are provisioned through the Azure portal, CLI, PowerShell, or infrastructure-as-code (ARM/Bicep). Each resource has an endpoint URL and authentication credentials. Choose between Free (F0) and Standard (S0) tiers based on throughput needs and SLA requirements.

Provisioning Methods

Azure Portal (GUI)

1. Navigate to Create a resource → AI + Machine Learning
2. Select the desired AI service (e.g., "Azure AI services" for multi-service)
3. Configure: Subscription, Resource Group, Region, Name, Pricing Tier
4. Review and Create

Azure CLI

# Create a resource group
az group create --name rg-ai-prod --location eastus

# Create a multi-service Azure AI resource
az cognitiveservices account create \
    --name my-ai-services \
    --resource-group rg-ai-prod \
    --kind CognitiveServices \
    --sku S0 \
    --location eastus \
    --yes

# Create a single-service Vision resource
az cognitiveservices account create \
    --name my-vision-service \
    --resource-group rg-ai-prod \
    --kind ComputerVision \
    --sku S1 \
    --location eastus \
    --yes

# Get the endpoint and keys
az cognitiveservices account show \
    --name my-ai-services \
    --resource-group rg-ai-prod \
    --query "properties.endpoint"

az cognitiveservices account keys list \
    --name my-ai-services \
    --resource-group rg-ai-prod

ARM Template (Infrastructure as Code)

{
    "type": "Microsoft.CognitiveServices/accounts",
    "apiVersion": "2023-05-01",
    "name": "my-ai-services",
    "location": "eastus",
    "kind": "CognitiveServices",
    "sku": {
        "name": "S0"
    },
    "properties": {
        "publicNetworkAccess": "Enabled",
        "customSubDomainName": "my-ai-services"
    }
}

Bicep Template

resource aiServices 'Microsoft.CognitiveServices/accounts@2023-05-01' = {
    name: 'my-ai-services'
    location: 'eastus'
    kind: 'CognitiveServices'
    sku: {
        name: 'S0'
    }
    properties: {
        publicNetworkAccess: 'Enabled'
        customSubDomainName: 'my-ai-services'
    }
}

Pricing Tiers

On the Exam: Free tier (F0) is sufficient for development but has no SLA and strict rate limits. Production scenarios always require Standard (S0) or higher. Questions may test whether you know which tier provides an SLA.

Endpoint and Authentication

Every Azure AI service resource exposes:

Using Keys in API Calls

import os
from azure.ai.vision.imageanalysis import ImageAnalysisClient
from azure.core.credentials import AzureKeyCredential

endpoint = os.environ["VISION_ENDPOINT"]
key = os.environ["VISION_KEY"]

client = ImageAnalysisClient(
    endpoint=endpoint,
    credential=AzureKeyCredential(key)
)

Using Entra ID (Preferred for Production)

from azure.identity import DefaultAzureCredential
from azure.ai.vision.imageanalysis import ImageAnalysisClient

endpoint = os.environ["VISION_ENDPOINT"]
credential = DefaultAzureCredential()

client = ImageAnalysisClient(
    endpoint=endpoint,
    credential=credential
)

Key Rotation Strategy

Azure provides two keys per resource to enable zero-downtime key rotation:

1. Applications use Key 1 for authentication
2. Regenerate Key 2 (applications unaffected — still using Key 1)
3. Update applications to use Key 2
4. Regenerate Key 1 (applications unaffected — now using Key 2)
5. Update applications back to Key 1 (or continue using Key 2)

On the Exam: Questions about key rotation test whether you understand that two keys exist specifically to enable rotation without downtime. The correct sequence involves switching applications to the secondary key before regenerating the primary key.

Regional Availability Considerations

Not all Azure AI services are available in every region. Key factors:

• Data residency: Choose a region that meets compliance requirements (e.g., EU data must stay in EU regions)
• Service availability: Azure OpenAI Service is only available in select regions (East US, West Europe, etc.)
• Latency: Choose the region closest to your users for lowest latency
• Paired regions: Consider disaster recovery with Azure region pairs